Privacy policy
This GDPR and Slovak Act No. 18/2018 Coll. notice explains how the operator (a natural person) processes personal data on the free NajGastro.sk project.
Last updated: 8 October 2026
Controller and contact
The natural person operating the website https://www.najgastro.sk (location: Slovensko). Contact: info@najgastro.sk. NajGastro.sk is currently a non-commercial, free project — we do not sell goods or services, subscriptions, or paid listings. For privacy inquiries contact info@najgastro.sk. To exercise your rights, email from your registered address or provide verifiable identification.
Personal data we process
Account: email, display name (optional), profile photo (optional), and a cryptographic password hash stored in the local authentication database. Reviews: text, rating, date, link to account. Visit photos: image file, link to business and account, moderation status (pending / approved / rejected) and optional rejection reason. Businesses: contact and operational data (submitted by owners or signed-in users), address, GPS, photos, opening hours. Technical data: IP, browser type, essential cookies, security logs. Footer newsletter: email and consent. Account email notification preferences (new review, review report, NajGastro news, etc.). Aggregated business profile view statistics.
Purposes and legal bases
Providing the free service (account, business profile, reviews, visit photos) — Art. 6(1)(b) GDPR. Legitimate interests (security, abuse prevention, aggregated statistics, moderation and handling reports) — Art. 6(1)(f) GDPR. Consent (public newsletter, optional cookies, opted-in NajGastro news emails in settings) — Art. 6(1)(a) GDPR; you may withdraw consent at any time. We do not use data for paid marketing or selling contact lists.
Retention
Account and business profile: for the life of the account plus up to 3 years unless longer retention is required. Reviews: while the business profile is public; may be anonymized after account deletion. Visit photos: until rejection, deletion by user/admin, or account deletion. Newsletter: until consent is withdrawn. Technical logs: typically 90 days.
Recipients and processors
The following categories of recipients and processors may process personal data: the VPS hosting provider (we operate the PostgreSQL database, local authentication, media storage, and outbound email on the VPS), mapping service providers (OpenStreetMap and Google Maps Platform), and analytics providers when enabled. We maintain GDPR Art. 28 data processing agreements with providers that act as processors. We do not sell personal data for marketing.
Transfers outside the EEA
Some providers may process data outside the EU/EEA. We use appropriate safeguards (EU Standard Contractual Clauses or adequacy decisions). Details available on request.
Account email notifications
In Dashboard → Settings you may opt in to account-linked transactional and product emails (e.g. new review on your business, review report, NajGastro news, new events and tips). The newsletter toggle is the same subscription as the footer signup. These options are off by default (opt-in), except where email is necessary to provide the service. You can change or disable them anytime in settings.
Your rights
You have the right of access, rectification, erasure, restriction, portability (where applicable), objection to legitimate-interest processing, and withdrawal of consent. Contact info@najgastro.sk; we respond within 30 days.
Supervisory authority
You may lodge a complaint with Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27, https://dataprotection.gov.sk. We recommend contacting us first so we can resolve the issue directly.
Security and changes
We apply appropriate technical and organizational measures (encryption in transit, access controls, updates). We may update this policy; material changes will be published here with an effective date.